DNSSEC

The Domain Name Sys­tem Secu­ri­ty Exten­sions (DNSSEC) is a stan­dard­ized pro­to­col of com­mu­ni­ca­tion allow­ing to resolve secu­ri­ty prob­lems relat­ed to DNS. We will begin by a reminder of what is the DNS.

How does the DNS work?

The DNS will allow web user to inform a domain name in his web brows­er to access a web­site. The brows­er will then “resolve” this domain name to obtain the IP address of the web serv­er which hosts this web­site and dis­plays it. We call this the “DNS res­o­lu­tion”.

DNSSEC process:

To secure the integri­ty of the DNS res­o­lu­tion, DNSSEC devel­ops a chain of trust that goes back to the DNS root. Data secu­ri­ty is done by keys mech­a­nism (KSK for Key Sign­ing Key & ZSK for Zone Sign­ing Key) which signs DNS records in its own zone. Pub­lic keys are sent to the cor­re­spond­ing reg­is­ter to be archived; the reg­is­ter being linked by DNSSEC to the root serv­er, the chain of trust is devel­oped. Each DNS par­ent zone ensures the keys authen­tic­i­ty of its child zones by sign­ing them.